Testing web applications using clusters

ABSTRACT

An example system includes a processor to crawl a plurality of web pages of a web application to be tested. The processor is to also receive an intercepted input to the web application and an output from a web application associated with each crawled web page. The processor is to further detect testable elements in the intercepted input and the output. The processor is also to generate a fingerprint for each web page based on the detected testable elements. The processor is to generate a list of clusters comprising one or more similar web pages based on the fingerprints. The processor is to test a single web page from each cluster.

BACKGROUND

The present techniques relate to testing web applications. Morespecifically, the techniques relate to testing web applications usingclusters.

SUMMARY

According to an embodiment described herein, a system can include aprocessor to crawl a plurality of web pages of a web application to betested. The processor can also further receive an intercepted input tothe web application and an output from the web application associatedwith each crawled web page. The processor can also detect testableelements in the intercepted input and the output. The processor can alsogenerate a fingerprint for each web page based on the detected testableelements. The processor can further generate a list of clusterscomprising one or more similar web pages based on the fingerprints. Theprocessor can also further test a single web page from each cluster.

According to another embodiment described herein, a method can includecrawling, via a processor, a plurality of web pages of a web applicationto be tested. The method can also further include receiving, via theprocessor, an intercepted input to the web application and an outputfrom the web application associated with each crawled web page. Themethod can also include detecting, via the processor, testable elementsin the intercepted input and the output. The method can further includegenerating, via the processor, a fingerprint for each web page based onthe detected testable elements. The method can also include generating,via the processor, a list of clusters comprising one or more similar webpages based on the fingerprints. The method can also further includetesting, via the processor, a single web page from each cluster.

According to another embodiment described herein, a computer programproduct for testing web applications can include computer-readablestorage medium having program code embodied therewith. The computerreadable storage medium is not a transitory signal per se. The programcode is executable by a processor to cause the processor to crawl aplurality of web pages of a web application to be tested. The programcode can also cause the processor to receive an intercepted input to theweb application and an output from the web application associated witheach crawled web page. The program code can also cause the processor todetect testable elements in the intercepted input and the output. Theprogram code can also cause the processor to generate a fingerprint foreach web page based on the detected testable elements. The program codecan also cause the processor to also further generate a list of clusterscomprising one or more similar web pages based on the fingerprints. Theprogram code can also cause the processor to test a single web page fromeach cluster.

BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWINGS

FIG. 1 is a block diagram of an example system that can test webapplications using clusters;

FIG. 2 is an information flow diagram of an example method for testingapplications pages using clusters;

FIG. 3 is a process flow diagram of an example method for testing webapplications using cluster predictions;

FIG. 4 is a block diagram of an example cloud computing environmentaccording to embodiments described herein;

FIG. 5 is an example abstraction model layers according to embodimentsdescribed herein; and

FIG. 6 is an example tangible, non-transitory computer-readable mediumthat can test web applications using clusters.

DETAILED DESCRIPTION

Dynamic web application testers can test web applications by crawlingweb applications in their entirety and testing all the elements of eachweb application. For example, dynamic testing of web applications mayinclude two phases: crawling and testing. The objective of the crawlingphase may be to identify all testable elements in a web application. Forexample, the testable element may include parameters, cookie values,etc. In the testing phase, the dynamic web application tester can thenattack testable elements and validate tests on the testable elements.However, such dynamic web scanning may not be able to scan large webapplications due to the vast number of web pages to crawl to and theamount of testable elements per page combined with the physicalconstraints of machines.

According to embodiments of the present techniques a processor may testweb applications using clusters. For example, the processor can crawl aplurality of web pages of a web application to be tested. The processormay receive an intercepted input to a web application and an output fromthe web application associated with each crawled web page. For example,the input may include a Hypertext Transfer Protocol (HTTP) request andthe output may include an HTTP response. The processor may also detecttestable elements in the intercepted input and the output. The processormay further generate a fingerprint for each web page based on thedetected testable elements. The processor may then generate a list ofclusters comprising one or more similar web pages based on thefingerprints. The processor may then test a single web page from eachcluster. For example, since each cluster may have been created by thesame server-side application functionality, only one page from eachcluster may be tested. Thus, the present techniques may able to reducethe number of web pages to be tested and thus increase the efficiency ofthe dynamic web application tester. In some experiments, the number ofweb pages to be tested to provide the same testing coverage was shown tobe reduced by a factor of 10-20×. The present techniques may be able tofurther increase efficiency by predicting which requests would result inadditional web pages in a cluster that would be redundant for purposesof testing. For example, the processor may be able to generate a maximaldistance between requests for each cluster in the list of clusters anddetect that the request would not result in a web page that belongs toany cluster based on the maximal distances for the clusters. Thus, thetechniques may enable additional efficiency for a web application testeronce a list of clusters has been generated. Furthermore, in someexamples, the processor can detect a security vulnerability based on thetesting and modify the web application to prevent the securityvulnerability. For example, the processor may remove characters fromuser input that can result in the execution of unauthorized scripts.

In some scenarios, the techniques described herein may be implemented ina cloud computing environment. As discussed in more detail below inreference to at least FIGS. 4, 5, and 6, a computing device configuredto test web applications using clusters may be implemented in a cloudcomputing environment. It is understood in advance that although thisdisclosure may include a description on cloud computing, implementationof the teachings recited herein are not limited to a cloud computingenvironment. Rather, embodiments of the present invention are capable ofbeing implemented in conjunction with any other type of computingenvironment now known or later developed.

Cloud computing is a model of service delivery for enabling convenient,on-demand network access to a shared pool of configurable computingresources (e.g. networks, network bandwidth, servers, processing,memory, storage, applications, virtual machines, and services) that canbe rapidly provisioned and released with minimal management effort orinteraction with a provider of the service. This cloud model may includeat least five characteristics, at least three service models, and atleast four deployment models.

Characteristics are as follows:

On-demand self-service: a cloud consumer can unilaterally provisioncomputing capabilities, such as server time and network storage, asneeded automatically without requiring human interaction with theservice's provider.

Broad network access: capabilities are available over a network andaccessed through standard mechanisms that promote use by heterogeneousthin or thick client platforms (e.g., mobile phones, laptops, and PDAs).

Resource pooling: the provider's computing resources are pooled to servemultiple consumers using a multi-tenant model, with different physicaland virtual resources dynamically assigned and reassigned according todemand. There is a sense of location independence in that the consumergenerally has no control or knowledge over the exact location of theprovided resources but may be able to specify location at a higher levelof abstraction (e.g., country, state, or datacenter).

Rapid elasticity: capabilities can be rapidly and elasticallyprovisioned, in some cases automatically, to quickly scale out andrapidly released to quickly scale in. To the consumer, the capabilitiesavailable for provisioning often appear to be unlimited and can bepurchased in any quantity at any time.

Measured service: cloud systems automatically control and optimizeresource use by leveraging a metering capability at some level ofabstraction appropriate to the type of service (e.g., storage,processing, bandwidth, and active user accounts). Resource usage can bemonitored, controlled, and reported providing transparency for both theprovider and consumer of the utilized service.

Service Models are as follows:

Software as a Service (SaaS): the capability provided to the consumer isto use the provider's applications running on a cloud infrastructure.The applications are accessible from various client devices through athin client interface such as a web browser (e.g., web-based email). Theconsumer does not manage or control the underlying cloud infrastructureincluding network, servers, operating systems, storage, or evenindividual application capabilities, with the possible exception oflimited user-specific application configuration settings.

Platform as a Service (PaaS): the capability provided to the consumer isto deploy onto the cloud infrastructure consumer-created or acquiredapplications created using programming languages and tools supported bythe provider. The consumer does not manage or control the underlyingcloud infrastructure including networks, servers, operating systems, orstorage, but has control over the deployed applications and possiblyapplication hosting environment configurations.

Infrastructure as a Service (IaaS): the capability provided to theconsumer is to provision processing, storage, networks, and otherfundamental computing resources where the consumer is able to deploy andrun arbitrary software, which can include operating systems andapplications. The consumer does not manage or control the underlyingcloud infrastructure but has control over operating systems, storage,deployed applications, and possibly limited control of select networkingcomponents (e.g., host firewalls).

Deployment Models are as follows:

Private cloud: the cloud infrastructure is operated solely for anorganization. It may be managed by the organization or a third party andmay exist on-premises or off-premises.

Community cloud: the cloud infrastructure is shared by severalorganizations and supports a specific community that has shared concerns(e.g., mission, security requirements, policy, and complianceconsiderations). It may be managed by the organizations or a third partyand may exist on-premises or off-premises.

Public cloud: the cloud infrastructure is made available to the generalpublic or a large industry group and is owned by an organization sellingcloud services.

Hybrid cloud: the cloud infrastructure is a composition of two or moreclouds (private, community, or public) that remain unique entities butare bound together by standardized or proprietary technology thatenables data and application portability (e.g., cloud bursting forload-balancing between clouds).

A cloud computing environment is service oriented with a focus onstatelessness, low coupling, modularity, and semantic interoperability.At the heart of cloud computing is an infrastructure comprising anetwork of interconnected nodes.

With reference now to FIG. 1, an example computing device can test webapplications using clusters. The computing device 100 may be forexample, a server, a network device, desktop computer, laptop computer,tablet computer, or smartphone. In some examples, computing device 100may be a cloud computing node. Computing device 100 may be described inthe general context of computer system executable instructions, such asprogram modules, being executed by a computer system. Generally, programmodules may include routines, programs, objects, components, logic, datastructures, and so on that perform particular tasks or implementparticular abstract data types. Computing device 100 may be practiced indistributed cloud computing environments where tasks are performed byremote processing devices that are linked through a communicationsnetwork. In a distributed cloud computing environment, program modulesmay be located in both local and remote computer system storage mediaincluding memory storage devices.

The computing device 100 may include a processor 102 that is to executestored instructions, a memory device 104 to provide temporary memoryspace for operations of said instructions during operation. Theprocessor can be a single-core processor, multi-core processor,computing cluster, or any number of other configurations. The memory 104can include random access memory (RAM), read only memory, flash memory,or any other suitable memory systems.

The processor 102 may be connected through a system interconnect 106(e.g., PCI®, PCI-Express®, etc.) to an input/output (I/O) deviceinterface 108 adapted to connect the computing device 100 to one or moreI/O devices 110. The I/O devices 110 may include, for example, akeyboard and a pointing device, wherein the pointing device may includea touchpad or a touchscreen, among others. The I/O devices 110 may bebuilt-in components of the computing device 100, or may be devices thatare externally connected to the computing device 100.

The processor 102 may also be linked through the system interconnect 106to a display interface 112 adapted to connect the computing device 100to a display device 114. The display device 114 may include a displayscreen that is a built-in component of the computing device 100. Thedisplay device 114 may also include a computer monitor, television, orprojector, among others, that is externally connected to the computingdevice 100. In addition, a network interface controller (NIC) 116 may beadapted to connect the computing device 100 through the systeminterconnect 106 to the network 118. In some embodiments, the NIC 116can transmit data using any suitable interface or protocol, such as theinternet small computer system interface, among others. The network 118may be a cellular network, a radio network, a wide area network (WAN), alocal area network (LAN), or the Internet, among others. An externalcomputing device 120 may connect to the computing device 100 through thenetwork 118. In some examples, external computing device 120 may be anexternal webserver 120. In some examples, external computing device 120may be a cloud computing node.

The processor 102 may also be linked through the system interconnect 106to a storage device 122 that can include a hard drive, an optical drive,a USB flash drive, an array of drives, or any combinations thereof. Insome examples, the storage device may include a crawler module 124, areceiver module 126, a detector module 128, a fingerprint generatormodule 130, a cluster generator module 132, a tester module 134, and apredictor module 136. In some examples, one or more of the modules124-136 may be implemented in an application or a web browser plugin.The crawler module 124 can crawl a plurality of web pages of a webapplication to be tested. For example, given one or more seed uniformresource locators (URLs), the crawler module 124 can download the webpages associated with the URLs, extract any hyperlinks contained in theURLs, and add the hyperlinks to a list of URLs to visit, also known as acrawl frontier.

URLs from the crawl frontier are then recursively visited according tothe crawler's policy. The receiver module 126 can then receive anintercepted input to a web application and an output from the webapplication associated with each crawled web page. For example, theinput may include an HTTP request and the output may include an HTTPresponse. In some examples, the input may include a GET parameter andthe output may include a document object model. For example, thedocument object model may be a tree structure of a web page. Thedetector module 128 can detect testable elements in the interceptedinput and the output. The fingerprint generator module 130 can generatea fingerprint for each web page based on the detected testable elements.For example, the fingerprint for each web page may include a pluralityof response element fingerprints and a plurality of request elementfingerprints. For example, the response element fingerprints may includeconcatenated fingerprints of a number of extracted response elements ina response. The request element fingerprints may include concatenatedfingerprints of a number of extracted request elements in a request. Insome examples, the fingerprint generator 130 can calculate a similarityscore between the fingerprint for each web pages and each cluster in thelist of clusters based on a calculated hamming distance. The clustergenerator module 132 can generate a list of clusters comprising one ormore similar web pages based on the fingerprints. For example, thecluster generator 132 can calculate a similarity score between afingerprint for a web page from the plurality of web pages and a clusterfrom the list of clusters. The cluster generator 132 can then add theweb page to the cluster in response to detecting that the similarityscore exceeds a similarity threshold. In some examples, the clustergenerator module 132 can calculate a similarity score between thefingerprint for each web page and each cluster in the list of clustersbased on a calculated hamming distance or any other suitable linearblock code technique. In some examples, the cluster generator module 132can calculate a hamming distance for a fingerprint of a web page and acluster by detecting the number of positions in two comparedfingerprints at which corresponding symbols are different. For example,the hamming distance may indicate the number of substitutions to be madeto change one fingerprint into the other. The tester module 134 can testa single web page from each cluster. Thus, the tester module 134 mayefficiently test web applications by testing a single web page from eachcluster and not every web page, while maintaining testing coverage.

In some examples, the predictor module 136 can generate a maximaldistance between requests for each cluster in the list of clusters. Insome examples, the predictor module 136 may receive a request to be sentto the web application. The predictor module 136 can then detect thatthe request would not result in a web page that belongs to any clusterbased on the maximal distances for the clusters. In some examples, thecrawler module 124 can then send the request to a web application inresponse to detecting that the request would not result in the web pagethat belongs to any cluster. In some examples, the crawler module 124may not send the request to a web application in response to detectingthat the request would result in the web page that belongs to a cluster.Thus, the predictor module 136 may enable the crawler module 124 toperform more efficiently by sending a reduced number of requests andenable the receiver module 126 to perform more efficiently by notreceiving web pages that would not be used in testing.

It is to be understood that the block diagram of FIG. 1 is not intendedto indicate that the computing device 100 is to include all of thecomponents shown in FIG. 1. Rather, the computing device 100 can includefewer or additional components not illustrated in FIG. 1 (e.g.,additional memory components, embedded controllers, modules, additionalnetwork interfaces, etc.). Furthermore, any of the functionalities ofthe crawler module 124, the receiver module 126, the detector module128, the fingerprint generator module 130, the cluster generator module132, the tester module 134, and the predictor module 136, may bepartially, or entirely, implemented in hardware and/or in the processor102. For example, the functionality may be implemented with anapplication specific integrated circuit, logic implemented in anembedded controller, or in logic implemented in the processor 102, amongothers. In some embodiments, the functionalities of the crawler module124, the receiver module 126, the detector module 128, the fingerprintgenerator module 130, the cluster generator module 132, the testermodule 134, and the predictor module 136, can be implemented with logic,wherein the logic, as referred to herein, can include any suitablehardware (e.g., a processor, among others), software (e.g., anapplication, among others), firmware, or any suitable combination ofhardware, software, and firmware.

FIG. 2 is a process flow diagram of an example method for testingapplications pages using clusters. The method 200 can be implementedwith any suitable computing device, such as the computing device 100 ofFIG. 1. For example, the method can be implemented via the processor 102of computing device 100.

At block 202, a processor crawls a plurality of web pages of a webapplication to be tested. For example, the web pages of the webapplication may be recursively visited according to a crawling policy.In some examples, the crawling policy may be a selection policy thatstates the pages to be downloaded. For example, a selection policy maybe a focused crawling policy that looks for similarity of web pages to agiven query. In some examples, a selection policy may be a URLnormalization policy that tries to normalize a URL to avoid redundantcrawling. In some examples, the crawling policy may be a parallelizationpolicy that uses many crawlers in parallel to increase crawlingefficiency. For example, the parallelization policy can state how tocoordinate a plurality of distributed web crawlers.

At block 204, the processor receives an intercepted input to the webapplication and an output from a web application associated with eachcrawled web page. For example, the intercepted input may be a HTTPrequest. In some examples, the output may be an HTTP response. In someexamples, the processor can intercept input to a web application, sendthe input to the web application if the input would not result in a webpage that belongs to any cluster based on the maximal distancescalculated for list of clusters, and receive an output from the webapplication in response to the input.

At block 206, the processor detects testable elements in the interceptedinput and the output. For example, testable elements in the input caninclude schemes, ports, parameters, cookies, headers, etc. In someexamples, the testable elements in the output can include documentobject model (DOM) elements of HTTP responses.

At block 208, the processor generates a fingerprint for each web pagebased on the detected testable elements. For example, the processor cangenerate a fingerprint for each element in a request resulting in theweb page and a fingerprint for each element in the web page and combinethe fingerprints for the elements to generate the fingerprint for eachweb page. In some examples, the fingerprint for a web page may begenerated using a dictionary or vector that counts the number ofoccurrences of testable elements in the requests and responses of a webpage. For example, the processor may count the number of query or bodyparameters in the request. In some examples, the processor can count thenumber of specific HTML elements in the response. Thus, the fingerprintmay be based on a concatenation of both the fingerprints generated forinput elements and fingerprints generated for output elements.

At block 210, the processor generates a list of clusters comprising oneor more similar web pages based on the fingerprints. For example, theclusters may represent web pages with similar server-side functionality.In some examples, the web pages in a cluster may be the output of thesame server-side functionality or script. In some examples, theprocessor may take two of the fingerprints and calculate a similaritybased on an average of the ratios of each of the testable elements. Insome examples, the processor can calculate a similarity score between afingerprint for a web page from the plurality of web pages and a clusterfrom the list of clusters and add the web page to the cluster inresponse to detecting that the similarity score exceeds a similaritythreshold. In some examples, the processor can calculate a similarityscore between the fingerprint for each web pages and each cluster in thelist of clusters based on a calculated hamming distance. For example,the hamming distance may indicate number of positions in two comparedfingerprints at which corresponding symbols are different. In someexamples, the processor can calculate a similarity score by calculatingmin-wise independent permutations (MinHash). For example, MinHash may beused to calculate the ratio of the number of elements of an intersectionbetween two fingerprints and the number of elements of their unionwithout explicitly computing the intersection and the union. In someexamples, the processor may calculate a similarity score using a SimHashhashing function. For example, similar elements may be hashed to similarhash values having low hamming distances.

At block 212, the processor tests a single web page from each cluster.For example, since each cluster is believed to have been created by thesame server side functionality, only one page from each cluster may betested. In some examples, the processor can then detect a securityvulnerability based on the testing and modify the web application toprevent the security vulnerability. For example, the processor mayremove characters from user input that can result in the execution ofunauthorized scripts. In some examples, if a security vulnerability isdetected from the single page tested, the processor can modify the webapplication to affect each of the pages of the cluster and prevent thesecurity vulnerability.

The process flow diagram of FIG. 2 is not intended to indicate that theoperations of the method 200 are to be executed in any particular order,or that all of the operations of the method 200 are to be included inevery case. Additionally, the method 200 can include any suitable numberof additional operations.

FIG. 3 is a process flow diagram of an example method for testing webapplications using cluster predictions. The method 300 can beimplemented with any suitable computing device, such as the computingdevice 100 of FIG. 1. For example, the method can be implemented via theprocessor 102 of computing device 100.

At block 302, the processor receives a list of clusters. For example,the list of clusters may have been generated using the method 200 above.

At block 304, the processor generates a maximal distance for eachcluster in the list of clusters. For example, the processor can generatea maximal distance between requests for a cluster by calculatingsimilarity scores between requests resulting in the web pages in thecluster. The maximal distance may be a similarity score that is lowerthan other similarity scores in the cluster. In some examples, thesimilarity scores can be calculated using any suitable form of hammingdistance. In some examples, the maximal distance between requests in acluster can be stored as a variable of the cluster. Thus, for everyweb-page that is inserted into the cluster, the processor can considerthe request that preceded the web page, and iteratively compute thesimilarity between the request and other requests in the cluster. Forexample, a similarity score can be calculated using any suitablevariation of a hamming distance. In some examples, the hamming distancecan be performed on a portion of the request, rather than every part ofthe request.

At block 306, the processor receives a request to be sent to a webapplication. For example, the request to be sent may be a textualrepresentation of a request that may have been intercepted beforereaching the web application. In some examples, the request may be sentto the target web application in a test environment. For example, therequest to be sent may be generated from a received test input. In someexamples, the request can be generated automatically. For example, theprocessor may generate the request by parsing previous responses andextracting new links. In some examples, the request can be givendirectly. For example, the processor may receive starting URLs, alsoknown as seeds, and generate the request based on the received startingURLs. In some examples, the request can be generated by interceptingdata from a client to the web application. For example, processor mayintercept the data at a browser.

At decision diamond 308, the processor determines whether the request tobe sent would result in a web page that belongs to a cluster based onthe maximal distances. For example, if the request is within the maximaldistance of a cluster then the processor may detect that the requestwould result in a web page that would belong to the cluster. If therequest would not result in a web page that belongs to a cluster, thenthe method may continue at block 310. If the request would result in aweb page that belongs to a cluster, then the method may continue atblock 312.

At block 310, the processor sends the request. For example, theprocessor may send the request to a target web application. For example,the requests may be sent to the web application in a testingenvironment. The processor may then receive a response that can beprocessed according to the method 200 of FIG. 2 above.

At block 312, the processor does not send the request. For example,since the request may not return any useful web page for testing, boththe resources used to send the request and the resources used to receivethe web page can be used for other processing. Thus, the processor maybe able to more efficiently test the web application by reducing thenumber of web pages to be clustered.

The process flow diagram of FIG. 3 is not intended to indicate that theoperations of the method 300 are to be executed in any particular order,or that all of the operations of the method 300 are to be included inevery case. Additionally, the method 300 can include any suitable numberof additional operations.

Referring now to FIG. 4, an illustrative cloud computing environment 400is depicted. As shown, cloud computing environment 400 comprises one ormore cloud computing nodes 402 with which local computing devices usedby cloud consumers, such as, for example, personal digital assistant(PDA) or cellular telephone 404A, desktop computer 404B, laptop computer404C, and/or automobile computer system 404N may communicate. Nodes 402may communicate with one another. They may be grouped (not shown)physically or virtually, in one or more networks, such as Private,Community, Public, or Hybrid clouds as described hereinabove, or acombination thereof. This allows cloud computing environment 400 tooffer infrastructure, platforms and/or software as services for which acloud consumer does not need to maintain resources on a local computingdevice. It is understood that the types of computing devices 404A-Nshown in FIG. 4 are intended to be illustrative only and that computingnodes 402 and cloud computing environment 400 can communicate with anytype of computerized device over any type of network and/or networkaddressable connection (e.g., using a web browser).

Referring now to FIG. 5, a set of functional abstraction layers providedby cloud computing environment 400 (FIG. 4) is shown. It should beunderstood in advance that the components, layers, and functions shownin FIG. 5 are intended to be illustrative only and embodiments of theinvention are not limited thereto. As depicted, the following layers andcorresponding functions are provided.

Hardware and software layer 500 includes hardware and softwarecomponents. Examples of hardware components include mainframes, in oneexample IBM® zSeries® systems; RISC (Reduced Instruction Set Computer)architecture based servers, in one example IBM pSeries® systems; IBMxSeries® systems; IBM BladeCenter® systems; storage devices; networksand networking components. Examples of software components includenetwork application server software, in one example IBM WebSphere®application server software; and database software, in one example IBMDB2® database software. (IBM, zSeries, pSeries, xSeries, BladeCenter,WebSphere, and DB2 are trademarks of International Business MachinesCorporation registered in many jurisdictions worldwide).

Virtualization layer 502 provides an abstraction layer from which thefollowing examples of virtual entities may be provided: virtual servers;virtual storage; virtual networks, including virtual private networks;virtual applications and operating systems; and virtual clients. In oneexample, management layer 504 may provide the functions described below.Resource provisioning provides dynamic procurement of computingresources and other resources that are utilized to perform tasks withinthe cloud computing environment. Metering and Pricing provide costtracking as resources are utilized within the cloud computingenvironment, and billing or invoicing for consumption of theseresources. In one example, these resources may comprise applicationsoftware licenses. Security provides identity verification for cloudconsumers and tasks, as well as protection for data and other resources.User portal provides access to the cloud computing environment forconsumers and system administrators. Service level management providescloud computing resource allocation and management such that requiredservice levels are met. Service Level Agreement (SLA) planning andfulfillment provide pre-arrangement for, and procurement of, cloudcomputing resources for which a future requirement is anticipated inaccordance with an SLA.

Workloads layer 506 provides examples of functionality for which thecloud computing environment may be utilized. Examples of workloads andfunctions which may be provided from this layer include: mapping andnavigation; software development and lifecycle management; virtualclassroom education delivery; data analytics processing; transactionprocessing; and web application testing.

The present techniques may be a system, a method or computer programproduct. The computer program product may include a computer readablestorage medium (or media) having computer readable program instructionsthereon for causing a processor to carry out aspects of the presentinvention.

The computer readable storage medium can be a tangible device that canretain and store instructions for use by an instruction executiondevice. The computer readable storage medium may be, for example, but isnot limited to, an electronic storage device, a magnetic storage device,an optical storage device, an electromagnetic storage device, asemiconductor storage device, or any suitable combination of theforegoing. A non-exhaustive list of more specific examples of thecomputer readable storage medium includes the following: a portablecomputer diskette, a hard disk, a random access memory (RAM), aread-only memory (ROM), an erasable programmable read-only memory (EPROMor Flash memory), a static random access memory (SRAM), a portablecompact disc read-only memory (CD-ROM), a digital versatile disk (DVD),a memory stick, a floppy disk, a mechanically encoded device such aspunch-cards or raised structures in a groove having instructionsrecorded thereon, and any suitable combination of the foregoing. Acomputer readable storage medium, as used herein, is not to be construedas being transitory signals per se, such as radio waves or other freelypropagating electromagnetic waves, electromagnetic waves propagatingthrough a waveguide or other transmission media (e.g., light pulsespassing through a fiber-optic cable), or electrical signals transmittedthrough a wire.

Computer readable program instructions described herein can bedownloaded to respective computing/processing devices from a computerreadable storage medium or to an external computer or external storagedevice via a network, for example, the Internet, a local area network, awide area network and/or a wireless network. The network may comprisecopper transmission cables, optical transmission fibers, wirelesstransmission, routers, firewalls, switches, gateway computers and/oredge servers. A network adapter card or network interface in eachcomputing/processing device receives computer readable programinstructions from the network and forwards the computer readable programinstructions for storage in a computer readable storage medium withinthe respective computing/processing device.

Computer readable program instructions for carrying out operations ofthe present techniques may be assembler instructions,instruction-set-architecture (ISA) instructions, machine instructions,machine dependent instructions, microcode, firmware instructions,state-setting data, or either code or object code written in anycombination of one or more programming languages, including an objectoriented programming language such as Smalltalk, C++ or the like, andconventional procedural programming languages, such as the “C”programming language or similar programming languages. The computerreadable program instructions may execute entirely on the user'scomputer, partly on the user's computer, as a stand-alone softwarepackage, partly on the user's computer and partly on a remote computeror entirely on the remote computer or server. In the latter scenario,the remote computer may be connected to the user's computer through anytype of network, including a local area network (LAN) or a wide areanetwork (WAN), or the connection may be made to an external computer(for example, through the Internet using an Internet Service Provider).In some embodiments, electronic circuitry including, for example,programmable logic circuitry, field-programmable gate arrays (FPGA), orprogrammable logic arrays (PLA) may execute the computer readableprogram instructions by utilizing state information of the computerreadable program instructions to personalize the electronic circuitry,in order to perform aspects of the present techniques.

Aspects of the present techniques are described herein with reference toflowchart illustrations and/or block diagrams of methods, apparatus(systems), and computer program products according to embodiments of thetechniques. It will be understood that each block of the flowchartillustrations and/or block diagrams, and combinations of blocks in theflowchart illustrations and/or block diagrams, can be implemented bycomputer readable program instructions.

These computer readable program instructions may be provided to aprocessor of a general purpose computer, special purpose computer, orother programmable data processing apparatus to produce a machine, suchthat the instructions, which execute via the processor of the computeror other programmable data processing apparatus, create means forimplementing the functions/acts specified in the flowchart and/or blockdiagram block or blocks. These computer readable program instructionsmay also be stored in a computer readable storage medium that can directa computer, a programmable data processing apparatus, and/or otherdevices to function in a particular manner, such that the computerreadable storage medium having instructions stored therein comprises anarticle of manufacture including instructions which implement aspects ofthe function/act specified in the flowchart and/or block diagram blockor blocks.

The computer readable program instructions may also be loaded onto acomputer, other programmable data processing apparatus, or other deviceto cause a series of operational steps to be performed on the computer,other programmable apparatus or other device to produce a computerimplemented process, such that the instructions which execute on thecomputer, other programmable apparatus, or other device implement thefunctions/acts specified in the flowchart and/or block diagram block orblocks.

Referring now to FIG. 6, a block diagram is depicted of an exampletangible, non-transitory computer-readable medium 600 that can test webapplications using clusters. The tangible, non-transitory,computer-readable medium 600 may be accessed by a processor 602 over acomputer interconnect 604. Furthermore, the tangible, non-transitory,computer-readable medium 600 may include code to direct the processor602 to perform the operations of the methods 200 and 300 of FIGS. 2 and3 above.

The various software components discussed herein may be stored on thetangible, non-transitory, computer-readable medium 600, as indicated inFIG. 6. For example, a crawler module 606 includes code to crawl aplurality of web pages of a web application to be tested. A receivermodule 608 includes code to receive an intercepted input to the webapplication and an output from a web application associated with eachcrawled web page. For example, the input may include an HTTP request ora GET parameter and the output may include an HTTP response or adocument object model. A detector module 610 includes code to detecttestable elements in the intercepted input and the output. A fingerprintgenerator module 612 includes code to generate a fingerprint for eachweb page based on the detected testable elements. For example, thefingerprint generator module 612 can include code to generate afingerprint for each element in a request resulting in the web page anda fingerprint for each element in the web page. The fingerprintgenerator module 612 also include code to combine the fingerprints forthe elements to generate the fingerprint for each web page. A clustergenerator module 614 includes code to generate a list of clustersincluding one or more similar web pages based on the fingerprints. Forexample, the cluster generator module 614 can include code to calculatea similarity score between a fingerprint for a web page from theplurality of web pages and a cluster from the list of clusters and addthe web page to the cluster in response to detecting that the similarityscore exceeds a similarity threshold. In some examples, the clustergenerator module 614 can include code to calculate a similarity scorebetween the fingerprint for each web pages and each cluster in the listof clusters based on a calculated hamming distance. A tester module 616includes code to test a single web page from each cluster. A predictormodule 618 includes code to generate a maximal distance between requestsfor each cluster in the list of clusters. In some examples, thepredictor module 618 can include code to generate a maximal distancebetween requests for a cluster by calculating similarity scores betweenrequests resulting in the web pages in the cluster. For example, themaximal distance may be a similarity score that is lower than the othersimilarity scores. The predictor module 618 can also include code toreceive a request to be sent to the web application. The predictormodule 618 can include code to detect that the request would not resultin a web page that belongs to any cluster based on the maximal distancesfor the clusters. The crawler module 606 can then send the request inresponse to detecting that the request would not result in the web pagethat belongs to any cluster. Thus, the predictor module 618 may enablethe crawler module 606 to operate more efficiently by reducingunnecessary requests from being sent and also prevent unnecessary webpages from being received at the receiver module 608. It is to beunderstood that any number of additional software components not shownin FIG. 6 may be included within the tangible, non-transitory,computer-readable medium 600, depending on the particular application.

The flowchart and block diagrams in the Figures illustrate thearchitecture, functionality, and operation of possible implementationsof systems, methods, and computer program products according to variousembodiments of the present techniques. In this regard, each block in theflowchart or block diagrams may represent a module, segment, or portionof instructions, which comprises one or more executable instructions forimplementing the specified logical function(s). In some alternativeimplementations, the functions noted in the block may occur out of theorder noted in the figures. For example, two blocks shown in successionmay, in fact, be executed substantially concurrently, or the blocks maysometimes be executed in the reverse order, depending upon thefunctionality involved. It will also be noted that each block of theblock diagrams and/or flowchart illustration, and combinations of blocksin the block diagrams and/or flowchart illustration, can be implementedby special purpose hardware-based systems that perform the specifiedfunctions or acts or carry out combinations of special purpose hardwareand computer instructions.

The descriptions of the various embodiments of the present techniqueshave been presented for purposes of illustration, but are not intendedto be exhaustive or limited to the embodiments disclosed. Manymodifications and variations will be apparent to those of ordinary skillin the art without departing from the scope and spirit of the describedembodiments. The terminology used herein was chosen to best explain theprinciples of the embodiments, the practical application or technicalimprovement over technologies found in the marketplace, or to enableothers of ordinary skill in the art to understand the embodimentsdisclosed herein.

What is claimed is:
 1. A computer system for testing web applications,the computer system comprising: one or more computer processor; one ormore computer readable storage media; and program instructions, storedon the one or more computer readable storage media for execution by atleast one of the one or more computer processors, the programinstructions comprising: program instructions to receive an interceptedinput to a web application; program instructions to cause theintercepted input to be sent to the web application as a request inputwhere a similarity score between the intercepted input and any one ofthe one or more web page requests is less than a maximal distance scoreof the given web cluster, wherein the similarity score is between theintercepted input and one or more web page requests, where each web pagerequest is associated with a web page of a given web cluster; programinstructions to receive the output for the intercepted input from theweb application; program instructions to detect testable elements in theintercepted input and output; program instructions to generate acombined fingerprint for the intercepted input and output based on thedetected testable elements from the intercepted input and the output bycounting the number of occurrences of the detected testable elements inthe intercepted input and the output; program instructions to add theoutput to one cluster of the list of web page clusters based onsimilarity between the combined fingerprint and the one cluster; andprogram instructions to test a single web page from each cluster of thelist of web page clusters.
 2. The computer system of claim 1, whereinthe intercepted input comprises a hypertext transfer protocol (HTTP)request and the output comprises a hypertext transfer protocol (HTTP)response.
 3. The computer system of claim 1, wherein the test of thesingle web page from the given web cluster includes the processor beingfurther configured to detect a security vulnerability based on theintercepted input; and modify the web application to prevent thedetected security vulnerability in each web page of the given webcluster.
 4. The computer system of claim 1, wherein the processor isconfigured to calculate a similarity score between a combinedfingerprint for a respective web page from the web cluster and arespective cluster from a list of clusters and add the respective webpage to the respective cluster in response to detecting that thesimilarity score exceeds a similarity threshold.
 5. The computer systemof claim 1, wherein the processor is configured to calculate asimilarity score between the combined fingerprint and each cluster in alist of clusters based on a calculated hamming distance.
 6. The computersystem of claim 1, wherein the combined fingerprint for each web pagecomprises a plurality of response element fingerprints and a pluralityof request element fingerprints.
 7. The computer system of claim 1,wherein the maximal distance score of the given web cluster is generatedby calculating the similarity of each of one or more web page requeststhat resulted in a web page associated with the given web page cluster.8. A computer-implemented method for testing web applications, themethod comprising the steps of: receiving, by one or more computerprocessors, an intercepted input to a web application where theintercepted input is configured to cause the web application to providea responsive web page as an output for the intercepted input; causing,by one or more computer processors, the intercepted input to be sent tothe web application as a request input where a similarity score betweenthe intercepted input and any one of the one or more web page requestsis less than a maximal distance score of the given web cluster, whereinthe similarity score is between the intercepted input and one or moreweb page requests, where each web page request is associated with a webpage of a given web cluster; receiving, by one or more computerprocessors, the output for the intercepted input from the webapplication; detecting, by one or more computer processors, testableelements in the received request and response; generating, via aprocessor, a combined fingerprint for each web page based on a firstfingerprint generated from the detected testable elements from theintercepted request and a second fingerprint generated from the detectedtestable elements of the response by counting the number of occurrencesof the detected testable elements in the intercepted input and theoutput; adding, by one or more computer processors, the output to onecluster of the list of web page clusters based on similarity between thecombined fingerprint and the one cluster; testing, by one or morecomputer processors, a single web page from each cluster of the list ofweb page clusters.
 9. The computer-implemented method of claim 8,further comprising: calculating, by one or more computer processors, asimilarity score between the combined fingerprint for a web page fromthe plurality of web pages and a cluster from a list of clusters; andadding, by one or more computer processors, the web page to the clusterin response to detecting that the similarity score exceeds a similaritythreshold.
 10. The computer-implemented method of claim 8, furthercomprising calculating, by one or more computer processors, a similarityscore between the fingerprint and each cluster in a list of clustersbased on a calculated hamming distance.
 11. The computer-implementedmethod of claim 8, wherein the step of generating the combinedfingerprint for each web page comprises the steps of: generating, by oneor more computer processors, a first fingerprint representing eachelement in a GET request and a second fingerprint for each element of adocument object model returned as a response to the GET request; andcombining, by one or more computer processors, the first and secondfingerprints for the elements to generate the combined fingerprint foreach web page.
 12. The computer-implemented method of claim 8, furthercomprising steps of: sending, by one or more computer processors, theintercepted input to the web application if the intercepted input wouldnot result in a web page that belongs to any cluster based on maximaldistances calculated for the list of clusters; and receiving, by one ormore computer processors, an output from the web application in responseto the intercepted input.
 13. The computer-implemented method of claim8, further comprising the step of generating, by one or more computerprocessors, the a maximal distance between requests for a cluster bycalculating similarity scores between requests resulting in the webpages in the given web cluster, wherein the maximal distance comprises asimilarity score that is lower than other similarity scores.
 14. Thecomputer-implemented method of claim 8, wherein the maximal distancescore of the given web cluster is generated by calculating thesimilarity of each of the one or more web page requests that resulted ina web page associated with the given web page cluster.
 15. A computerprogram product for testing web applications, the computer programproduct comprising: one or more computer readable storage media; andprogram instructions stored on the one or more computer readable storagemedia, the program instructions comprising: program instructions toreceive an intercepted input to a web application, where the interceptedinput is configured to cause the web application to provide a responsiveweb page as an output for the intercepted input; program instructions tocause the intercepted input to be sent to the web application as arequest input where a similarity score between the intercepted input andany one of the one or more web page requests is less than a maximaldistance score of the given web cluster, wherein the similarity score isbetween the intercepted input and one or more web page requests, whereeach web page request is associated with a web page of a given webcluster; program instructions to receive the output for the interceptedinput from the web application; program instructions to detect testableelements in the intercepted input and the output; program instructionsto generate a combined fingerprint for each web page based on a firstfingerprint of the detected testable elements from the intercepted inputand a second fingerprint of the detected testable element from theoutput by counting the number of occurrences of the detected testableelements in the intercepted input and the output; program instructionsto add the output to one cluster of the list of web page clusterscomprising one or more similar web pages based on similarity between thecombined fingerprint and the one cluster; and program instructions totest a single web page from each cluster of the list of web pageclusters.
 16. The computer program product of claim 15, furthercomprising program instructions, stored on the one or more computerreadable storage media, to calculate a similarity score between afingerprint for a web page from the plurality of web pages and a clusterfrom a list of clusters, and to add the web page to the cluster inresponse to detecting that the similarity score exceeds a similaritythreshold.
 17. The computer program product of claim 15, furthercomprising program instructions, stored on the one or more computerreadable storage media, to calculate a similarity score between thefingerprint for each web page and each cluster in a list of clustersbased on a calculated hamming distance.
 18. The computer program productof claim 15, further comprising program instructions, stored on the oneor more computer readable storage media, to: generate a fingerprint foreach element in a request resulting in the web page and a fingerprintfor each element in the web page; and combine the fingerprints for theelements to generate the fingerprint for each web page.
 19. The computerprogram product of claim 15, further comprising program instructions,stored on the one or more computer readable storage media, to generate amaximal distance between requests for a cluster by calculatingsimilarity scores between requests resulting in the web pages in thecluster, wherein the maximal distance comprises a similarity score thatis lower than other similarity scores.
 20. The computer program productof claim 15, wherein the maximal distance score of the given web clusteris generated by calculating the similarity of each of the one or moreweb page requests that resulted in a web page associated with the givenweb page cluster.